Anchor linux_arm64 select key to the codeql repo

When `codeql_platform_select` builds its `select` from a macro invoked in
another workspace (e.g. semmle-code consuming this repo as `@codeql`), a bare
`//misc/bazel:linux_arm64` string key resolves against the consuming repo and
fails with "no such package 'misc/bazel'". Use `Label(...)`, which resolves
relative to this file's own repo, so the key always binds to
`@codeql//misc/bazel:linux_arm64` regardless of the calling workspace.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c5c5b0bf-4afa-468c-b2dd-197d80932b4b

Author: redsun82

misc/bazel/os.bzl

@@ -23,8 +23,9 @@ def codeql_platform_select(
     def _or_otherwise(value):
         return value if value != None else otherwise
 
+    linux_arm64_setting = Label("//misc/bazel:linux_arm64")
     choices = {
-        "//misc/bazel:linux_arm64": _or_otherwise(linux_arm64),
+        linux_arm64_setting: _or_otherwise(linux_arm64),
         "@platforms//os:linux": _or_otherwise(linux64),
         "@platforms//os:macos": _or_otherwise(osx64),
         "@platforms//os:windows": _or_otherwise(win64),
@@ -40,7 +41,7 @@ def codeql_platform_select(
         return ctx.target_platform_has_constraint(getattr(ctx.attr, "_%s_constraint" % constraint)[platform_common.ConstraintValueInfo])
 
     if has("linux"):
-        result = choices["//misc/bazel:linux_arm64"] if has("arm64") else choices["@platforms//os:linux"]
+        result = choices[linux_arm64_setting] if has("arm64") else choices["@platforms//os:linux"]
     elif has("macos"):
         result = choices["@platforms//os:macos"]
     elif has("windows"):